1. Field of the Invention
The present invention involves a method and an apparatus for authentication of a user attempting to access an electronic service, and, in particular, providing an authentication unit which is separate from preexisting systems.
2. Description of Related Art
Effective authentication methods and apparatuses have been in great demand to prevent fraud and theft of services. This demand increases with the explosion of electronic services in the current information age. Electronic services such as banking services, credit card services, automatic teller machine (ATM) services, account information services such as mortgage, savings and investment accounts, general information services such as data base services and networks, security services and long distance phone services all require that a user be accurately identified for purposes of security, proper billing and avoidance of fraud. Recently, fraud in the cellular mobile telephone industry has placed so great a demand on effective authentication methods that a protocol has been standardized for cellular mobile systems. See, GSM 03.20, European Telecommunications Standards Institute (ETSI), 1993, pp. 19-29 and U.S. Pat. No. 5,282,250, herein incorporated by reference.
However, conventional authentication systems have required specially equipped terminals with card readers such as ATMs or credit card gas station terminals, data terminals using a log-in procedure, or cellular mobile radio stations with built-in authentication capabilities. Credit cards having a magnetic snip provide only minimal security insomuch as the bearer of the card is usually permitted to conduct transactions without further authentication of the user's identification other than perhaps comparing a unauthenticated signature on the card to a signature of the user. Even in transactions when signatures are required, the certainty of the user's identification is minimal.
Other identity cards, such as ATM cards, require a log-on procedure with a password, or PIN. But the PIN, once learned by an unauthorized user, offers no security in authenticating the user if the user can duplicate the ATM card.
These methods of authentication require specially equipped, and often dedicated, terminals, which raises the cost and reduces the availability of the associated electronic service. In other words, the prior art security systems often require a dedicated or customized terminal or modification to existing terminals, which greatly restricts the use of security systems to specific sites. Also, a user may use several electronic services, each service requiring an authentication procedure and/or personal identification number (PIN) or password, each procedure or password different from the others. As a subscriber to several electronic services, a user might end up with numerous passwords to remember. Even worse, he or she may be required to change these passwords periodically, thus having to remember if a password is still valid or not.
Also, transactions requiring relatively certain authentication have been largely unavailable from relatively simple terminals like telephones. For instance, home banking by telephone has been limited to transactions involving the bank customer's own accounts or using only the customer's own telephone.